Slashdot Mirror
Do You Allow Webmail Use on Your Network?
rtobyr asks: "I don't allow users at my organization to use any third party e-mail. When users complain, I point out that we can't control the security policies of outside systems. End users tend to think that big business will of course have good security; so I ran a test of the 'Big Four': Hotmail, Yahoo Mail, AOL/AIM Mail, and GMail. Yahoo Mail was the only webmail provider to allow delivery of a VBS script. GMail was the only provider to block a zipped VBS script. End users also tend to think that a big business would never pull security features out from under their customers. Of course, we know that AOL and Microsoft have both compromised the security of their customers. I don't know of any security related bad press for Yahoo or Google. Three of my Big Four either allow VBS attachments or have a poor security track records. So, if you are a network administrator, do you limit your users' ability to use third party e-mail, and if so, do you allow for GMail or other providers that you've deemed to have secure systems and reputations?"
Not to mention, who cares what the webmail services allow? Just because they allow a user to receive - say - a VBS file doesn't mean that you have to allow that onto your network or that you can't block such an attachment and allow the webmail.
I'm glad I don't work at your organization!
Seriously, webmail has so much use that blocking it is ultimately counterproductive -- the only equivalent "security" would be totally blocking net access.
If you are worried about productivity loss, well, I often use webmail so I can stay at work longer. Really, it's not hard to imagine that allowing people to use light net access for personal communication means that they do not have to physically leave work to do these things. It's a bonus for all.
If you are worried about security, any net access that allows submission of forms or uploading of files is equivalent security breach. As stated before, any moderately skilled hacker can configure a proxy to get data off your network.
You're crippling your users and kidding yourself.
Simply put, yes.
We would prefer that the work e-mail not be used for personal mailings. One of the reasons is file storage space.
We are willing acknowledge that the parents are going to communicate with their kids, and other folks with friends and family. It makes for better employee morale when they are permitted access to web mail for such things, leading to less abuse of work systems. It is better to use e-mail than the phone, which needs to be left free for actual business calls with clients.
Are there security concerns? Though the poster found some concerns, those concerns are easily disarmed by a good anti-virus/anti-spyware program.
Sure, we could be rather draconian and put the kabosh on all of it, but it comes back to employee morale. A happy worker is a productive worker. Our workers are given the task of being responsible and are rewarded for their success.
Bearded Dragon
Translation: my organizations' computers are not secure enough to safely access the Internet. This is somehow Google/Yahoo/MSN's fault.
I don't care if it's 90,000 hectares. That lake was not my doing.
I guess I understand that, but the bummer is that for a lot of us we don't work just your basic 9-5. If you work a lot its nice to be able to take care of a little personal business, in fact I think it probably increases productivity by making people more willing to hang around at work a little longer. So in that regard these bans are counterproductive.
I don't think IT people really think about stuff like that much...the ideal situation for IT isn't necessarily whats best for the enterprise. That said I can see how security and document retention are valuable goals...maybe webmail could provide some kind of mechanism to allow companies to hook into it and archive messages read or sent using corporate machines. Same for instant messengers. Then everyone's happy (except privacy advocates...)
Making a non-webmail page with links to nasty VBS scripts, etc. is just as easy as send an e-mail, so you are not really protecting your network by these annoying limitations... An attacker can send your charges an e-mail (at the corporate address) with a link to his script. And if you check all browsing (via scanning proxies), then you may as well leave webmails alone, for they'll be checked too, along with all other HTML pages.
You are not alone, unfortunately. I found, that whenever admins (pompously) argue for strict banishment of a particular "attack vector", they almost always ignore another vector for the same attack.
There could be one justification for banning external (non-corporate) means of communications, while at work — compliance and legal issues. A big bank, for example, does not want a broker to be able to claim, that a bank's trader ordered a (bad) trade via. GMail or cell-phone. But this only makes sense, when your official (corporate) communications get recorded and archived (unlike private webmail accounts and personal cell-phones), and can be played back.
In short, you have to remember, that you (an administrator) exist for the benefit and convenience of these people, not the other way around. So if they want to be able to access their webmail, you must have a much better reason than "you may get a virus" to deny it to them.
I bet, more productivity is lost, when an employee brings in flu and half the office gets sick. But no one is advocating forcing people to take vitamin C and wear scarves, right?..
In Soviet Washington the swamp drains you.
This sounds less like a real Ask Slashdot question and more like "Hey look at me. I'm an IT fascist!"
Blocking webmail is pointless and serves only for you to needlessly flex your authority in the only part of the world you have authority: your company's network.
Seriously, if you are so paranoid about webmail, why allow internet to the desktop at all? Since you are so afraid of VBS, why don't you just lock out VBS execution at the desktop and keep your enterprise AV up2date?
Grow up, have kids, and annoy them with your stupid restrictions. Leave the people at work alone.
Long, Long ago we just disabled vbs execution across the whole enterprise.. we allow access to any of these services.
Got Code?
What stops an employee from doing this outside business hours? They could easily contact them at home with their personal account, or even using a blackberry or other smartphone, if they have that device configured to check mail.
I'm not sure how much this new legislation will prevent communication from being "lost" in the future any more than in the past. There have been laws on the books for several decades in regards to record keeping and keeping "paper trails" yet, there are always missing documents when some type of scandal or investigation causes the s$%t to hit the fan.
If someone's goal is to communicate in a secretive or malicious manner, its going to be done regardless of whether you can access gmail.com at work or not.
Exactly; in the name of freedom and promoting a healthy living culture in which employees are able to enjoy their life at work so they are more active and enthusiastic in being productive and creative when they need to, I feel it is extremely important to not impose restrictions (and especially IT restrictions) on the way employees work. In particular, other than offensive, insulting, dangerous, or pornographic content (which I understand), corporations should not block or attempt to control the websites its employees can access at work. An employee who can check his/her personal mail whenever he/she feels like will be much happier at the workplace than one who isn't.
Simply installing and updating a latest virus scanner on all corporate machines should be relatively simple.
Also, employees should be permitted to bring their own computers to use on the corporate network. How do you stop viruses?
1. Demand a periodic inspection of all Windows computers to ensure that the user is using an approved virus scanner that is set to automatically update.
2. Freely allow Linux machines to be plugged into the workplace. They are highly unlikely to cause any problems.
This is how at least two places I've worked at ran it, and employees were extremely happy.
Also, may I point out that my university (MIT) network has nearly no restrictions whatsoever on what you can plug in, what you can serve, and what you can run. I can run a mail server in the office if I want. I can run a web server in my dorm room. I can do essentially anything. The IS&T department here just has it structured pretty well so that nothing bad happens. Solid Unix/Linux servers, and automatic shut down of network drops that are spreading viruses or of Windows machines that appear vulnerable. It's great. I get freedom to do anything I want, and the network is very solid and reliable at the same time. I wish companies could do this too.
Sure, they may be required to archive information forever. I don't think that includes personal emails and personal phone calls. And if you work somewhere that you can't send a note to your wife or make a phone call to say you're going to be home late or ask how your spouse's doctor visit went, then it's time to get out. And I don't see how any private communications need to be archived.
:(
That said, there are simple workarounds. If your employer has some sort of SOCKS proxy, that's very simple to SSH through. One connect.c file and a line in a config file will get you working on OSX for example. Then you can use SSH, IMAP, HTTP and whatever else you want.
Or you could just have a Treo with unlimited internet service and do whatever you want.
That they have to archive communications or control business communications does not seem relevant. Simply have a policy that states "email services outside of the control of this company are not to be used for business correspondence". Seems simple enough.
Also, I know that at my company there have been times when the email has gone down and I've needed to send a small file to a client or request some information and I've had to do so through a non-business webmail account. Has saved much hassle and additional time that simply waiting around for email to return would have caused.
I think I would go insane if I had to work in the environment a lot of you describe being stuck in.
You know, its not always as sarcasticly simple as you want to make it out to be. The fact of the matter is, things like GLBA and SOX force IT departments to take these kinds of drastic measures whether we like it or not. They REQUIRE that you inventory 'customer sensitive data' and control the flow of that data. The CEO literally signs on the bottom line that the reports you give to the auditors are true. Not to the best of his knowledge or any cop outs like that. So, when the big guns come down from their gilded offices, and demand to know for a 'fact' that you have control over data, it doesn't matter that the steps you have to take might have little to no real world effect. You just have to take them. Yes, as a security professional, *I* understand that if I wanted to get customer sensitve data out of the network, I could write it on my own ass, and press it up against a window for the guy in the next building over to read. But my board of directors doesn't find that amusing. They know they are legally responsible now, and they must be seen to be doing *everything* possible to secure the data. This does include doing our best to block things like mail apps, IM apps, USB drives and the like. Personally, I can see MANY ways in which each of those things would streamline the business process, and provide actual performance and productivity increases for the business, but that doesn't matter because GLBA demands that if we were to use those things, we keep logs of ALL of the ways they were used for 3 years, that are indexed and searchable and online, and another 4 after that in archive format. So when you go to the accounting dept with your new budget with all these new equipment costs, and software costs, and you have to GUARANTEE legally that they can't be used in ways other than intended...guess what the simpler solution is? Thats right, they go away. And lets be honest, for every valid business purpose, there's an equal number of time wasting BS purposes for that stuff that expose the company to legal liability. And the fact of the matter is, if we have policies against it, procedures in place to prevent it, and you still manage to get it done, then we have a pretty damn good case in court to hang YOU out to dry and not the company. CYA for the big wigs, and frankly, for myself. I know as geeks and nerds we think we know best, but if you play hard enough, stuff does break. I know I've had my own little personal web host 'pwned' before, and thats being decently careful to lock things down. I can't imagine my 'lusers' having more access than they already do, and what they might 'accomplish' with that access. For my own sanity, our regulatory requirements, the CEOs CYAs, and to be able to support the secured environment that we do, things like you refer to so sarcasticaly would get you fired. We own that machine, we own the network its on, we own the bandwidth you use to connect to the outside world, and therefore, we get to say exactly what you get to do with it. If you don't like that, thats fine, I totally understand, leave. But sometimes, even though I personally don't like it, I 'get it'.
--Brian
My company hasn't flat out blocked web mail yet, but I'm sure they are on the way. IM was blocked awhile ago and a coworker got an email today from IT that she shouldn't check gmail anymore (she would just leave it up all day, which would let gmail do it's auto-refresh). The problem I have is that here at work we have 100MB of email space that gets backed up. On gmail I have 3-4gb. So while this one person got the email to quit using gmail the rest of the office is continuing to use gmail not just for personal mails, but also for work. Gmail is better than the IT solution, and users are smart enough to realize this. So as long as we have draconian, I know what's best for you IT people, we'll have users who do what they have to to get the job done.
Here's an idea! How about IT look to the users as customers and treat them that way.
[Disclaimer: I do risk and reg for a living]
Bull. Sarbanes Oxley says nothing of the sort. If you think it does, go read the regs. I don't believe you are intentionally lying, I just think you are misinformed and have no idea what you are talking about.
Do you allow jackasses to post to slashdot at work?
The truth suffers more from convictions than from lies.
Short Answer: Yes! Longer Answer: Oooooohhhhh Yeaaaaaaa! Anyone that doubts the collective idiocy of a user base most likely has never had to staff a corporate HelpDesk....
My question is... what exactly are you trying to secure? If you're talking about ensuring that sensitive corporate data isn't leaked outside the company, I hate to say it but, you really shouldn't be using unencrypted email in the first place. If you don't allow VPN's or other ways for people to access their email outside the building (I'm sure the salespeople LOVE you), then you may as well force your employees to use paper, or a custom client that only talks to other people on the LAN.
If you're worried about virus/malware/etc... web based email is no more or less safe than any other modern graphical pop3/imap client. All of them these days are HTML enabled, and unless you personally watch everyone click their messages, some will still run winbig.exe or whatever.
Personally, I'm getting a bit tired of people tossing the "security" word around as a reason to make things more difficult or expensive, without ever justifying what it is that needs the added security, and why.
I'm a network admin for a small-medium sized company, about 40 - 50 people. We are pretty liberal about our IT security policies. We're still at the size where we can place a great deal of trust in our staff, and they don't abuse it. For the most part, we don't block virtually any content. We've never had problems, but we're at a growth stage where we're needing to tighten up security a bit.
My girlfriend's company, which is a larger energy company of about 250 people, does however block some webmail content, as they recently had an employee download material that caused a security concern.
Personally, I don't think it's unreasonable to block web-based mail. However, since email is such a common place in daily life now, if I was to do that, I would make sure there were a few computers in a staff room where people could freely check their email, outside the companies' proxies and firewalls.
Way to remove your best talent there, chief.
And drive away the possibility of any new talent.
Javascript + Nintendo DSi = DSiCade
If the user has physical access to the computer you are fooling yourself if you think you can stop them with UAC.
I listed both SOX and GLBA. And you are correct, section 404 says nothing of the sort. Its the fact that it is so vague, that our regulators and auditors have expanded on its requirements just to 'be safe'. Go ahead and look up some of the recent commentary by Mr. Oxley himself. They realize they've created a monster by being so damn vague. GLBA is the same way. I'm paraphrasing, but the language says basically 'put into place a system of controls, and document those controls'. Then my conversations with my regulators go like this: Great, wtf does that mean? How about I just document what we currently do, and call that the controls...no? thats not good enough? Ok fine, tell me whats good enough...you cant? well how about some guidance...no you cant do that either? Ok fine. We'll just go whole hog to protect ourselves. And then they are happy.
--Brian
I am one such "Moderately Bright Chap".
I have putty on my computer and I run everything through a SOCKS proxy. I have Firefox, Thunderbird (no webmail for me) and iTunes all going through one of my few shells.
I occasionally surf between 0 and 3 hours a day: fark, slashdot, ebay, etc. Last year I received the highest rating that someone of my salary level could. My boss, my coworkers think I'm a magic man, when I'm asked to get something done I get it done as fast as possible. Techno &/or 80's music tends to set a rhythm for my coding, despite internet radio being frowned on (not officially banned). My parents are going through a divorce. I like to e-mail both of them and my siblings during the day, but I like to keep that off of corporate mail. Sometimes I want to win an auction during work and sometimes I just need a detox.
With all due respect, you and your company can go fuck themselves. If I got the lowest rating, then yes, there's a problem. But you and your company are automatically removing people like me because we get stuff done AND we have personal lives.
Content filter the secretary not the MSMEs.
The important thing is that you manage your corporate IT policies to make your job easier, and not to actually serve your customers: the employees who struggle to get their work done in spite of your draconian rules.
I work with similar issues: it can be interesting finding ways to get work done in spite of IT's (un)support and (un)help.
ShoutingMan.com
Thank you very much. Companies like yours are the reason companies like mine can hire brilliant and talented people away from bureaucratic nightmares and pay them 20% less while getting a significant amount more productivity from them. We have internal Web, IRC, chat, etc. servers. If your AOL IM is not working and it is stopping you from chatting with your girlfriend, IT is happy to help. They'll even grab you a beer from the fridge on the way to your desk. For smart people who know they'll spend a significant portion of their life at work, but who chose their work because they love it... there are companies like mine. You're treated like a real person instead of a cog. If you need to go home for the rest of the day while waiting for the plumber to come to your house, go ahead. Don't bother filling out paperwork or logging your time. So long as your work gets done, it's all to the good. If a friend is in town and stops by the office, go ahead and take a few hours to have a beer and play a video game with them in the lounge. Introduce them to your boss and coworkers.
We don't lock down Web access to any type of external site. We track everything, but the tracking system is open to all employees so if you want to see what your boss is doing, just log on and look. We don't seem to have a lot of IT emergencies either. Some of our old and out of date servers overheat or fall over now and again and we power cycle them. No big deal.
Every day I'm thankful I realized early in life that I did not want to take the top dollar offer for my work if it meant I had to put up with nonsense like you advocate. IT's job is not supposed to be to minimize the amount of work they need to do or even to prevent problems. It is supposed to be to facilitate the rest of the company getting work done. Happy employees work harder for the company and stay late to work on something or even come in on a weekend for some project. Happy employees do not quit and move to another company with no notice leaving the company in the lurch. Happy employees are not the largest and hardest to stop threat to the security of your network as they feel it is "wrong" to screw over the company and boss and people who treat them well and with understanding and who are their friends.
But by all means, keep making yourself hated and keep thinking your employees lives should stop and they should act like machines for 8 hours a day. We'll keep hiring away the smartest people you have.
The lad has made the correct decision, but for the wrong reasons. The number one reason is because you want all of your "business traffic" to go thru your corporate email system.
He should be asking himself, "Why do the people who work here feel they need to use the non-corporate system for business work?"
All my work email goes from my work account, personal goes thru gmail.
Also, if he doesn't allow people to use personal accounts for personal email, they'll just use the company email for that. Does he want that to happen?
The employer is only required to document communication which has occurred "related to" the business. If an employee chooses to contact a client from outside of the work place, outside of their working hours, this is not official communication by the bank and thus is unrelated. The employee is then at fault, but the employer is protected legally.
hackerkey://v4sw5/7BCHJMPRUY$hw3ln3pr6/7FOP$ck6ma8+9u6L$w4/7CGUXm0l6DLRi82NCe3+9t5Sb7HMOPRen5a17s0DSr1/2p-3.62/-5.23g3/5
Insightful? I thought this person was trying to be funny.
And that, my friends, pretty much summarizes the arguments for and against expanding H-1B caps.
I am not a crackpot.
I know SOX quite well, as internal SOX auditing is part of my job. Nice try. It seems like you're misinformed about SOX. SOX doesn't force IT departments to do anything, let alone "drastic measures."
Like I said in my original post, it's a good thing you're focused on the important activities of, "blocking mail apps, IM apps, USB drives and the like." You better ban laptops too! While you're at it, kill your users. They might *speak*. Well, you could rip out their vocal cords so they can't do that, but then they might use semaphores. Better ban flags too!
What you fail to realize is that your data is only secure as your users. I would say that you do not "get it" at all.
So, we use gmail. It's not elegant, but we can easily send the files we need back and forth and actually get our work done. So who's to blame when your gmail account gets cracked and your company's IP gets stolen? Your sysadmins for "forcing" you to use gmail?
I see what you're saying, but there's a difference in needs and motivations between a university and most companies. Universities specifically need freedom because they're largely interested in education (ok, maybe not really, but at least supposedly). Education requires freedom. Plus, the constant re-evaluation of the setup is educational. When you have a whole bunch of aspiring CS majors and academics without a whole lot of real work to do, you have a free workforce to constantly address the ever-changing threats to network security.
With most companies, there are very limited and specific goals. They can be summed up, like, "we have e-mail so our employees can communicate with customers," or "we have web access so our employees can research [whatever]." Once you've established those needs, they key thing is to enable those services in ways that are as simple and fool-proof as is humanly possible. "Fool-proof" almost always requires that you limit the number of activities that could happen to the activities you expect to happen, that you plan for, and that you would like to happen.
And often that's the real culprit here: opening the network to additional unplanned possibilities also opens it to possible unknown security failures. It's not fool-proof, and it doesn't offer the company any advantage, so there's a motive to block it but no motive for them to allow it.
You misunderstood my entire post. I stated quite clearly that I know for a fact that these measures most likely do not offer 'real world' security.
What I am saying is that none of that matters in the face of vague sets of regulatory requirements.
I see also that you chose to ignore the fact that I also listed GLBA as a requirement, as did a few others who responded.
I go through four to five audits per year. I have had to beg for specfiic guidelines, and have yet to receive any. And so, the safe thing to do is to appear to be trying as hard as possible.
The other thing that I *do* get is that as a self proclaimed geek (you are here arguing on the internets with me) that you might be naturally averse to a situation like the one we have here. Thats OK. And if you have the ability to pull up and leave for more open pastures, by all means, go. Go takea job where you aren't under this kind of insane scrunity. Really. I envy you that mobility.
However, the fact remains that this hardware belongs to the company. And if my boss says that after the latest audit, we're going to lock you down as tight as is possible, even if in real world terms it means nothing, then thats what I'm going to do. Thats what they PAY me for.
And whats more, actions like that do in fact, please regulators. And at the end of the day, if the regulators are happy, we get to continue to make money, rather than being fined or possibly even shut down. And when the business makes money, I make money. And that makes me happy.
--Brian
I have been using the same arguments about webmail to my network admin. Questions that receive no answers:
Why is webmail blocked but USB ports allow anyone to plug and play a thumb drive? Couldn't someone bring a virus in the same way?
Why do we block webmail but no other websites/services are blocked? Shouldn't we worry about someone surfing for pr0n or possibly looking for warez?
Often, I have heard the argument that IT doesn't want to let information get leaked via webmail and IM's. But all computers at my location have a CD-RW, plus 8 USB ports, a printer at each desk, etc. I would think its easier to track a file getting sent via webmail then it is to track a user who prints the document and walks out the front door.
That's not really a good argument. Just because security isn't perfect doesn't mean its useless. You might as well be arguing about removing all antivirus and firewalls, because someone has a USB port in their system.
Oh, so you do let them past the restrictions? Officially sanctioned and everything, I see? So basically you're telling me that your best talent would have no trouble defeating your measures (as I surmised) so you don't even try to put them in place for them? Why don't you try putting those measures in place for the researchers, and see how long your company has top talent in that area?
I think that right there sums up your attitude nicely. You treat your researchers like royalty (as you should), but apparently have no problems firing any of the support staff that might be critical to the researcher's work. Because, you know, they're not smart. They're just duh codeded minkeys. Anyone who shows a smidge of ingenuity and talent by getting past your firewall restrictions must, by defintion, be stupider than the rest. Weed 'em out!
Remind me never to work for your company. Or hire you.
Javascript + Nintendo DSi = DSiCade
Wow. Right now, I really wish there was a moderation option for "-1, Way Too Full of Himself."
/. (irony here?).
Not really - he has a point... If you're considered a good employee that gets his work done, why should anyone care if you slack once in a while? I sometimes find myself slacking off on
Doesn't make me a bad employee unless I miss targets for stuff. GP is bang on. If I get stuff done, why should IT care if I waste some time checking my personal email?
And no, the whole "it can bring vbs files to us" is crap because those can just as easily be downloaded off any site, and on top of that these email providers do some pretty good scans on their own too, and furthermore why do you, as a sysadmin not run good antivirus on your lan anyway?
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
I think it's great that your company is doing this. However, it reminds me of our government here in the USA and you could say across the world, in its over-reaction to security threats.
For example, one crazy suicide bomber tries to light a shoe bomb on a flight, and for months, millions of people had to take their shoes off before they were allowed on a commercial flight. That is a little over the top in my opinion.
So, if you take all of these security measures, but keep pissing off the people you're trying to protect yourself from, then they will eventually get around your security. A better approach may be to protect yourself, and try not to piss off any people in the process.
and work does not get done with viruses and worms rampaging on the network. work also doesn't get done when the boss goes to jail.
Snowden and Manning are heroes.
No site is ever 100% secure. IT/management generally shoot for the most bang for the buck, to get where the risk/cost ratio of a problem balances with the needs of their business objectives.
Why is webmail blocked but USB ports allow anyone to plug and play a thumb drive? Couldn't someone bring a virus in the same way?
And if they blocked up the usb ports, someone could come in with a SATA drive and a screw driver. Couldn't someone bring in a virus that way too? So why not install intrusion detection systems in all the cases...?? And on it goes.
The answer: risk/cost analysis indicates that email is by FAR the number 1 transport for viruses. Yes other vectors exist, but if you only deal with email you address the lions share of the risk.
Additionally, removing webmail is usually aligns with managements objectives, so blocking it generally gets immediate management support.
Why do we block webmail but no other websites/services are blocked? Shouldn't we worry about someone surfing for pr0n or possibly looking for warez?
The answer: risk/cost analysis again. You address the big problems before the little ones, and the little ones before the ones you don't even have (yet). IE - Knock out MSN/Yahoo/Gmail and you remove a huge chunk of the useless sites that staff ARE spending hours on. If its worth it, you could keep going after every porn or warez site too, but the returns rapidly diminish while the cost keeps going higher.
If surfing porn/warez was a rampant problem then you could expect management to address it with technology. But for most companies a policy against warez and porn is usually enough to keep the problem at minimal levels. (Hell, most of the time you don't even need formal policy, in my experience most people just 'know better' and don't have to be told that surfing porn at work is against policy and grounds to be fired.)
Weaning webmail addicts off their personal accounts, on the other hand, sometimes requires a little help from technology.
Due to being a thrall subject to corporate regs like SOX and others, I have to lock down user PCs, and restrict them behind a Draconian firewall, allowing access to only what they need to work.
However with Terminal Services clients, I enable it to be used in a client window, and make sure that "Turn off clipboard redirection" is off in group policy. All employees can connect to a cluster of Terminal Servers which is securely in a DMZ, isolated from the rest of the network. Only a few people have administrative rights to these machines, and the only connection the Terminal Server machines have to the internal network is a port to a dedicated domain controller. To further separate the employee "free for all" TS machines from the corporate network, they even are connected to the Internet on a different link. Of course, the TS machines have a few outgoing ports blocked at the router (port 25, duh), but its nowhere near as locked down as the internal corporate network.
Now, desktops can be locked down, but users can do pretty much what they want on their account on the terminal server (Webmail, IM, etc.) If a user gets malware, it can only affect their user accounts (assuming the malware gets past the AV scanner resident on the machine.) There is no known way the internal PCs can be infected by a compromised terminal server (if by chance something like this occurs), and confidential corporate material can't get out by accident via the clipboard (if someone wanted to get it out, they could manually type it, but that is a different story altogether.)
This has been a fascinating string. Thanks for all the interesting, and not so interesting responses. I like this fellow's attitude. It's too bad he had to waste time fiddling around with this. I woulda hooked him up. I've set up corporate networks for the allegedly clueful (software engineers) and the notoriously clueless (social agencies.) Both did great work. Both had different needs. In terms of the software folks, the technology of the day (and with VLANs and all the other stuff out there, easier now) made us simply set up a "red" network and a "blue" network. The "red" network was engineering's - period. We assigned a senior tech to it to keep working and fed it hardware. The senior tech ended up being a pretty good engineer. It was all good. His work got boring after a few weeks. New career. It turned out the software execs did not mind a bit spending extra $$$ for a separate T1 line, network gear and an extra workstation or two for EACH engineer because time to market is expensive and failure to market, extraordinarily expensive. Cheap stuff. But we had to ask the question and be aware of the business. The curmudgeons who refused to understand the business and operated out of personal pique and IT-think got the door - to a person. It turned out to be a cheap solution to an embedded organizational problem. My habit these days, for folks who want personal and business access is to invoke virtualization. Build a personal environment, as segregated as can be made from the business and let clients do their worst within it stating that "we're not responsible for whatever you do inside this sandbox". If it ends up getting trashed, we just re-image it. If the person is irresponsible, breaks this membrane and acts in a stupid and selfish fashion (morality cannot be legislated), well that's just grist for HR action against the goals of the organization. And probably another cheap lesson. According to the surveys I'm seeing, IT is hauling its sorry ass out of the financial hole it dug itself into for Y2K, dealing with SOX and other mandates and now ready for a little innovation and fun. It's about time. In any case, I recommend the embattled policy-enforcers get out of nimnod-land and into a place where you have some business cluefulness and stop calling the executives names. Maybe buy them a beer. Buy your clients a beer. If you have any kind of self-confidence you might find them interesting and mutually helpful. It's been known to happen. Otherwise, you will be treated like folks who believe wood weighs less than the witch. And that's a self-inflicted problem I see in business over and over and over again.
A lot of times consultants/contracts/vendors are going to be using webmail to communicate.
So if you are taking away webmail, you are effectively taking away email for these users. Which, needless to say, won't help their productivity. I once had to go back to my hotel during a workday just to collaborate with some experts within my own organization. After which I came back with a memory stick full of code we had built together offsite. The company wasn't any safer. (Actually they were less so, since the firewall never got to see or inspect my code). And the company was out several billable hours of time that I wasted trying to get the needed information and traveling offsite to get it.